guide · static export
Security

Turn On Controlled Folder Access Against Ransomware

Windows can block unknown programs from writing to your documents. It is off by default - and it is only usable once you allow the apps you actually trust.

by@guidox updated:10/30/26 time:20 min level:Intermediate tested on:Windows 11 24H2, Windows Defender works on:Windows 10 2004+, Windows 11 tools:Windows Security
TL;DR

Enable **Controlled folder access** under **Windows Security > Virus & threat protection > Ransomware protection**, then allow your backup, sync and editor apps one by one. Expect one week of prompts before it settles.

Before you start

Requirements

  • Windows 10 or 11 with the built-in Defender active
  • Admin rights
  • A list of the apps that write to Documents, Pictures and Desktop
Step by step

Instructions

01

Check what is protected

Open **Windows Security > Virus & threat protection > Manage ransomware protection** and look at **Protected folders**. By default it covers Documents, Pictures, Videos, Music and Desktop.

Windows Security > Virus & threat protection > Ransomware protection
02

Add your own folders

Add the folder that holds your projects or a second drive with family photos. Protection is per folder, so anything outside the list is unprotected.

tipAdd the source folder of your backup job, not the backup drive itself - blocking the backup tool helps nobody.
03

Switch it on

Turn **Controlled folder access** on. From this moment every unrecognised program that tries to write gets blocked and listed in the event log.

⚠ warningThird-party antivirus often disables this feature entirely. Check that Defender is the active engine first.
04

Allow the apps you trust

When something legitimately fails, open **Block history**, find the entry and choose **Allow on device**. Do it for backup tools, sync clients, photo editors and your IDE.

05

Read the blocks, do not click through

A block from a program you do not recognise is a warning, not an annoyance. Check the path - a document editor running from a temp folder is not a document editor.

⚠ warningAllow by executable path, never by name alone. Ransomware copies trusted names.
06

Test the safety net

Create a test file in Documents and try to modify it with a small unsigned script. The block has to appear in the history. If nothing happens, the feature is off or a policy disabled it.

tipOn a managed work PC the setting can be locked by policy - then this guide cannot be applied.
Troubleshooting

Common issues

The setting is greyed out

A third-party antivirus took over, or group policy manages the machine. Uninstall the other AV or ask the admin.

A game cannot save its config

Games often write to Documents. Allow the game executable, not the launcher, unless the launcher is what saves.

Backups fail silently

The backup service runs as SYSTEM under a different path than the user app. Allow that executable and re-run the job.

Too many prompts after an update

Updated binaries get new signatures. Re-allow after verifying the path is still inside Program Files.

FAQ

Frequently asked

Does this replace a backup?

No. It blocks writes; it does not restore anything. Keep an offline copy as well.

Does it slow the PC down?

Not measurably. It is a filter on file writes, not a scanner.

How to undo this

Turn **Controlled folder access** off again. The allowed apps and extra folders stay in the list and can be removed there.

Changelog · 1 entry
  1. 2026-10-30
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress